Phd Position F - M Phd Position F - M How Does Reasoning With Llm Help Repair Vulnerabilities In Repo-Level Software Projects H/F INRIA

PhD Position F/M PhD Position F/M: How does Reasoning with LLM Help Repair Vulnerabilities in Repo-level Software Projects?
Le descriptif de l'offre ci-dessous est en Anglais
Type de contrat : CDD

Niveau de diplôme exigé : Bac +5 ou équivalent

Fonction : Doctorant

A propos du centre ou de la direction fonctionnelle

The Inria Rennes - Bretagne Atlantique Centre is one of Inria's eight centres and has more than thirty research teams. The Inria Center is a major and recognized player in the field of digital sciences. It is at the heart of a rich R&D and innovation ecosystem: highly innovative PMEs, large industrial groups, competitiveness clusters, research and higher education players, laboratories of excellence, technological research institute, etc.

Contexte et atouts du poste

Within the framework of the ANR PRCI project "SecLLM4SVD (Secured Large Language Models in Reliable Software Vulnerability Detection)", Principal Investigator: Dr. Yufei Han.

Mission confiée

Context and Motivation:

Large Language Models (LLMs) have demonstrated remarkable capabilities in automating the detection of software vulnerabilities (SVD) due to their ability to process both natural and programming languages. However, a critical reliability concern with state-of-the-art LLMs is their susceptibility to adversarial attacks. Subtle, problem-space modifications to source code-such as variable renaming or dead code insertion-can mislead the model without changing the code's main functionality or underlying vulnerabilities. Furthermore, the opaque, "black-box" nature of LLMs makes it difficult to understand whether they truly grasp code semantics or simply recognize superficial statistical artifacts.

Collaboration :

The recruited person will be in connection with Dr. Yuejun Guo at Luxembourg Institute of Science and Technology.

Responsibilities :
The person recruited is responsible for conducing full-time research activities centered at the theme of the thesis.

Steering/Management :
The person recruited will be supervised by Dr. Yufei Han

Principales activités

Thesis Objectives

This 36-month PhD position aims to advance the state of the art in software security. It focuses on repository-level code vulnerability detection and root cause analysis using Large Language Models (LLMs). A central methodological thread is reinforcement learning (RL) fine-tuning to strengthen the reasoning capability of LLMs on security tasks. The candidate will lead research in two phases. The first phase targets deep vulnerability discovery across complex codebases. The second phase targets automated and reliable code remediation.

The first phase will focus on navigating complex repository structures to detect systemic vulnerabilities. Current LLMs often reason superficially over code. They struggle with long, multi-step analyses that span many files. The candidate will investigate Reinforcement Learning (RL)-based fine-tuning to improve the model's security reasoning. The model will be trained to produce structured reasoning chains that trace execution and data flows across functions, files, and libraries. Training will rely on verifiable reward signals. Examples include the correctness of the localized vulnerable code, the consistency of the inferred root cause, and confirmation by static analysis or proof-of-concept execution. The candidate will also study how RL can steer the model's analytical path during inference. This includes deciding which code regions to explore next and when to stop. The goal is to unveil hidden vulnerabilities that arise from intricate cross-function, cross-file, and cross-library dependencies. The approach moves beyond localized scanning. It aims to pinpoint the exact root causes of security flaws deeply embedded in the repository ecosystem.

Building on the identification and root cause analysis of the first phase, the second phase will shift to automated remediation. The candidate will explore how LLMs can produce robust fixes for the detected vulnerabilities. A key challenge is preserving utility integrity alongside the security gains. RL fine-tuning will again play a central role. The patch generation model will be optimized with multi-objective rewards. These rewards will capture whether the vulnerability is eliminated, whether existing tests still pass, and whether performance is preserved. The candidate will develop rigorous methodologies to ensure that generated patches integrate into the broader repository context. Patches must not break existing functionality, introduce regressions, or degrade performance. The final goal is reliable, production-ready code repair.

Compétences

Candidate Profile and Requirements

To successfully carry out the research objectives of WP2 and WP3, the ideal candidate should possess a strong foundational background in both artificial intelligence and software security. We are looking for candidates who meet the following requirements:

- Educational Background:A Master's degree or equivalent engineering degree in Computer Science, Artificial Intelligence, Cybersecurity, or a closely related discipline.
- Deep Learning Expertise:Solid knowledge and proven project experience in designing, training, and evaluating Deep Neural Network (DNN)-based classification models.
- Program Analysis Proficiency:Demonstrated understanding and practical experience in program analysis. Specifically, the candidate must be familiar with the static analysis of source code using semantic representations, such as Control Flow Graphs (CFG) and Data Flow Graphs (DFG).
- Programming Skills:Strong programming skills in Python and proficiency with standard deep learning frameworks (e.g., PyTorch, TensorFlow). Experience with code parsing and analysis tools (e.g., Tree-sitter, Joern) is highly desirable.
- Additional Assets:Prior exposure to Large Language Models (LLMs), Natural Language Processing (NLP), or Adversarial Machine Learning will be considered a significant plus.
- Soft Skills:Excellent analytical and problem-solving skills, an autonomous and rigorous work ethic, and good communication skills in English for scientific writing and presentation within an international consortium.

Avantages

- Subsidized meals
- Partial reimbursement of public transport costs
- Leave: 7 weeks of annual leave + 10 extra days off due to RTT (statutory reduction in working hours) + possibility of exceptional leave (sick children, moving home, etc.)
- Possibility of teleworking (after 6 months of employment) and flexible organization of working hours
- Professional equipment available (videoconferencing, loan of computer equipment, etc.)
- Social, cultural and sports events and activities
- Access to vocational training
- Social security coverage

Rémunération

monthly gross salary 2300 euros